THOR Lite Skill

THOR Lite is a free scanner with reduced features compared to full THOR. This skill handles Lite-specific guidance, limitations, and workarounds.

When to Use This Skill

• •User is running THOR Lite (binary name contains "lite")
• •User asks why a feature is missing or disabled
• •User expects "full THOR" behavior from Lite
• •User wants lab-like scanning with Lite
• •User asks about Lite vs full THOR differences

How to Identify THOR Lite

Check for these indicators in scan output:

1. •Binary name: thor64-lite.exe, thor-lite-linux-64, thor-lite-macos
2. •Version header: Shows "THOR Lite" or "Lite" in the banner
3. •Startup messages:
   • •"Some modules and features are not available in Lite version and will be disabled"
   • •"Disabled components ... REASON: Component is not available in THOR Lite"
   • •"REASON: License restrictions"

If unclear, ask the user for the first ~50 lines of their THOR output.

Binary Names

Key Limitations

Lab-Like Scanning Workaround

Since --lab is not available, use this flag combination for intensive scanning:

# Windows
thor64-lite.exe -a Filescan --intense --norescontrol --cross-platform -p <path>

# Linux
./thor-lite-linux-64 -a Filescan --intense --norescontrol --cross-platform -p <path>

# macOS
./thor-lite-macos -a Filescan --intense --norescontrol --cross-platform -p <path>

Be explicit: this provides similar behavior, not equal to full lab scanning.

Setting Expectations

When users run THOR Lite:

1. •Fewer detections expected – Open source signatures only (~4k vs 30k+ YARA rules)
2. •Modules are limited – Many persistence and analysis modules are disabled
3. •No Sigma – Event log analysis with Sigma rules requires full THOR
4. •No Lens – Audit trail output requires full THOR v11
5. •Scan may seem quiet – This is normal for Lite's reduced module set

When to Suggest Full THOR

Recommend upgrading when user needs:

• •Sigma/event log scanning
• •Audit trail for THOR Lens
• •Broader detection coverage
• •Full module set
• •Commercial/paid engagement use

Keep recommendations factual, not promotional.

Rules

1. •Identify Lite early – Check binary name and startup output before troubleshooting missing features
2. •Set expectations – Lite is for triage; missing detections are expected
3. •Provide workarounds – Use the lab-like flag combo when appropriate
4. •Don't promise full features – Workarounds approximate but don't equal full THOR
5. •Note license restrictions – Commercial use requires full THOR

References

• •THOR Lite Limitations – Full feature comparison and workarounds

Cross-References

• •Environment Detection – Binary detection and identification
• •Lab Mode – Full THOR lab mode documentation
• •THOR Lens – Requires full THOR v11 (not compatible with Lite)